North Korea’s growing criminal cyberthreat

Author

Disclosure statement

Dorothy Denning does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

Partners

The countries posing the greatest cyberthreats to the United States are Russia, China, Iran and North Korea. Like its counterparts, Kim Jong Un’s regime engages in substantial cyber espionage. And like Russia and Iran, it launches damaging cyberattacks that wipe data from computer disks and shut down online services.

But the North Korean cyberthreat is different in two ways. First, the regime’s online power did not grow out of groups of independent hackers. Even today, it seems unlikely the country has hackers who operate independent of the government. Second, North Korea’s cybercrime efforts – all seemingly state-sponsored – steal money that is then used to fund its cash-strapped government.

Government-controlled hacking

One reason for North Korea’s apparent lack of independent hackers is that most North Koreans do not have internet access. Although the country has had an internet connection through China for several years, it’s reserved for elites and foreign visitors. Would-be hackers can’t launch attacks across borders; they can’t even pick up hacking manuals, code and tips from the many online forums that other hackers in other nations use to learn the trade and share information.

On top of that, North Korea maintains exceptionally strong controls over its population. Any hacking attributed to North Korea is likely done for the government if not by the government directly.

State-sponsored hackers

North Korea’s cyber warriors work primarily for the General Bureau of Reconnaissance or the General Staff Department of the Korean People’s Army. Prospective candidates are selected from schools across the country and trained in cyber operations at Pyongyang University of Automation and other colleges and universities. By 2015, the South Korean military estimated the KPA employed up to 6,000 cyber warfare experts.

From espionage to sabotage

North Korea has been using cyber operations to spy on the U.S. and South Korea since at least 2004. U.S. targets have included military entities and the State Department. North Korea uses cyber espionage to acquire foreign technology, including technologies relating to weapons of mass destruction, unmanned aerial vehicles and missiles.

By 2009, North Korea had expanded its cyber operations to include acts of sabotage. The first of these took place in July 2009, when massive distributed denial of service (DDoS) attacks shut down targets in the U.S. and South Korea. The attackers also used “wiper” malware to delete data on disks.

In December 2014, the North’s attackers hit desktop computers in a South Korean nuclear plant with wiper malware that destroyed not only the data on hard drives, but also the master boot record startup software, making recovery more difficult. In addition, the attack stole and leaked blueprints and employee information from the plant.

Calling themselves the “Guardians of Peace,” the attackers demanded that Sony withhold release of the satirical film “The Interview,” which depicts an assassination attempt against North Korea’s leader, Kim Jong-un. The attackers also threatened violence against any movie theaters showing the film.

Although theaters initially canceled their scheduled showings, ultimately the film was released both online and in theaters. North Korea’s coercive attempts failed, as they have in other cases.

North Korea was not happy that Sony planned to release ‘The Interview,’ a comedy depicting the fictional killing of national leader Kim Jong Un.AP Photo/Ahn Young-joon

Financial crimes

In recent years, North Korea started using cyber operations to generate revenue for the government. This is done through several illicit means, including outright theft of funds, extortion and cryptocurrency mining.

In early 2016, the regime came close to stealing US$951 million from the Bangladesh Central Bank over the global SWIFT financial network. Fortunately, because of a misspelling, they only succeeded in moving $81 million. Analysts attributed the attack to the “Lazarus Group,” the same group believed to be behind many of the attacks tied to North Korea, including those against Sony and other banks.

The Lazarus Group has also been blamed for the WannaCry ransomware that spread to computers in 150 countries in 2017. After encrypting data on a victim’s computer, the malware demanded payment in the bitcoin digital currency to get access back.

North Korea has been mining cryptocurrencies on hacked computers as well. The hijacked machines run software that “earns” the digital currency by performing a computationally difficult task. The funds are then directed into an account tied to the hackers.

A cybercrime power

Like other countries, North Korea uses cyber espionage and cyber sabotage to acquire secrets and harm adversaries. But it stands out from other countries in its use of cybercrime to finance its programs. This is perhaps not surprising given North Korea’s history of counterfeiting U.S. currency and using other illicit activities to acquire funds.

The introduction of online transactions and digital currencies, coupled with inadequate cybersecurity, has opened the doors to North Korea for illicitly acquiring funds by new means. Given the country’s appetite for building nuclear and other weapons, as well as the effects of economic sanctions, it seems likely that North Korea will continue to seek ways of exploiting the cyber world for economic advantage.